A critical authorization vulnerability in the Ajenti server admin panel allows low-privileged users to achieve root-level code execution and full host compromise.

The application fails to perform proper authorization checks when calling the /api/core/tasks/start endpoint. An authenticated user can trigger InstallPlugin or UnInstallPlugin tasks, which use unvalidated input to construct pip package commands that execute with root privileges.

The ability for a low-privileged user to execute arbitrary code as root represents the highest level of security risk. Successful exploitation grants an attacker complete control over the server, facilitating data theft, lateral movement within the network, and persistent system backdoors. Given the CVSS score of 9.9, this vulnerability must be treated as an immediate threat to business continuity and infrastructure integrity.

Immediate Action: Update the Ajenti server admin panel to version 2.2.16 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review system and application logs for unusual activity associated with the /api/core/tasks/start endpoint or unexpected execution of pip commands.

Compensating Controls: Implement strict network access controls to limit access to the Ajenti management interface to only trusted administrative IP addresses, and ensure the service is not exposed to the public internet.

Public Exploit Available: Unknown

The severity of this vulnerability cannot be overstated, as it provides a direct path to full administrative control of the host. Administrators should prioritize patching to version 2.2.16 as the primary mitigation strategy. If immediate patching is not feasible, restrict access to the panel to the absolute minimum number of authorized users and ensure the service is isolated behind a secure gateway.